処理の実行
AWS IDを取得します。
コマンド:
AWS_ID=$( \
aws sts get-caller-identity \
--query 'Account' \
--output text \
) \
&& echo ${AWS_ID}
結果(例):
IAMポリシードキュメントを作成します。
変数の確認:
cat << EOF
# FILE_IAM_POLICY_DOC:"${HOME}/environment/conf-handson-cli-ssm-session-manager/handson-SSMSessionManagerEndUser-policy.json"
FILE_IAM_POLICY_DOC="${FILE_IAM_POLICY_DOC}"
# AWS_ID:"XXXXXXXXXXXX"
AWS_ID="${AWS_ID}"
# SSM_DOCUMENT_NAME:"SSM-SessionManagerRunShell"
SSM_DOCUMENT_NAME="${SSM_DOCUMENT_NAME}"
# IAM_USER_PATH:"/handson-cli/"
IAM_USER_PATH="${IAM_USER_PATH}"
EOF
コマンド:
cat << EOF > ${FILE_IAM_POLICY_DOC}
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ssm:DescribeSessions",
"ssm:GetConnectionStatus",
"ssm:DescribeInstanceProperties",
"ec2:DescribeInstances"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "ssm:StartSession",
"Resource": [
"arn:aws:ec2:${AWS_DEFAULT_REGION}:${AWS_ID}:instance/*",
"arn:aws:ssm:${AWS_DEFAULT_REGION}:${AWS_ID}:document/${SSM_DOCUMENT_NAME}"
]
},
{
"Effect": "Allow",
"Action": "ssm:TerminateSession",
"Resource": "arn:aws:ssm:*:${AWS_ID}:session/\${aws:username}-*"
},
{
"Effect": "Allow",
"Action": "iam:GetUser",
"Resource": "arn:aws:iam::${AWS_ID}:user${IAM_USER_PATH}\${aws:username}"
}
]
}
EOF
cat ${FILE_IAM_POLICY_DOC}
結果(例):
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ssm:DescribeSessions",
"ssm:GetConnectionStatus",
"ssm:DescribeInstanceProperties",
"ec2:DescribeInstances"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "ssm:StartSession",
"Resource": [
"arn:aws:ec2:ap-northeast-1:XXXXXXXXXXXX:instance/*",
"arn:aws:ssm:ap-northeast-1:XXXXXXXXXXXX:document/SSM-SessionManagerRunShell"
]
},
{
"Effect": "Allow",
"Action": "ssm:TerminateSession",
"Resource": "arn:aws:ssm:*:XXXXXXXXXXXX:session/${aws:username}-*"
},
{
"Effect": "Allow",
"Action": "iam:GetUser",
"Resource": "arn:aws:iam::XXXXXXXXXXXX:user/handson-cli/${aws:username}"
}
]
}
JSONファイルを作成したら、フォーマットが壊れてないか必ず確認します。
コマンド:
cat ${FILE_IAM_POLICY_DOC} \
| python3 -m json.tool \
> /dev/null
結果(例):
完了確認
「IAMポリシードキュメント"${HOME}/environment/conf-handson-cli-ssm-session-manager/handson-SSMSessionManagerEndUser-policy.json"が存在する。」ことを確認します。
コマンド:
ls ${FILE_IAM_POLICY_DOC}
結果(例):
${HOME}/environment/conf-handson-cli-ssm-session-manager/handson-SSMSessionManagerEndUser-policy.json